Production browser span export: same-origin OTLP forwarded to Axiom#981
Merged
Conversation
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
executor-cloud | d53d12f | Jun 12 2026, 05:52 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
executor-marketing | d53d12f | Commit Preview URL Branch Preview URL |
Jun 12 2026, 05:50 PM |
RhysSullivan
force-pushed
the
claude/e2e-session-player
branch
from
cf8b558 to
0bfdc81
Compare
RhysSullivan
force-pushed
the
claude/prod-browser-traces
branch
from
7e649db to
9651044
Compare
This was referenced Jun 12, 2026
RhysSullivan
force-pushed
the
claude/e2e-session-player
branch
from
0bfdc81 to
eb848df
Compare
RhysSullivan
force-pushed
the
claude/prod-browser-traces
branch
2 times, most recently
from
0e6d5ae to
31eb6cd
Compare
Contributor
Cloudflare previewTorn down — the PR is closed. |
RhysSullivan
force-pushed
the
claude/e2e-session-player
branch
from
eb848df to
8a221c7
Compare
@executor-js/cli
@executor-js/config
@executor-js/execution
@executor-js/sdk
@executor-js/codemode-core
@executor-js/runtime-quickjs
@executor-js/plugin-file-secrets
@executor-js/plugin-graphql
@executor-js/plugin-keychain
@executor-js/plugin-mcp
@executor-js/plugin-onepassword
@executor-js/plugin-openapi
executor
commit: |
RhysSullivan
force-pushed
the
claude/prod-browser-traces
branch
from
31eb6cd to
8c0d322
Compare
RhysSullivan
force-pushed
the
claude/e2e-session-player
branch
from
8a221c7 to
e49bdd1
Compare
The web client's OTLP exporter now ships in the production build: wrangler.jsonc bakes VITE_PUBLIC_OTLP_TRACES_URL=/v1/traces, the client resolves it against the page origin, and a new worker route (observability/browser-traces.ts) forwards the batch to Axiom with the server-held token — the browser never sees AXIOM_TOKEN. The route runs before the worker's server span so exporter traffic doesn't trace itself, requires a session cookie to be present, caps body size, and never reflects Axiom's response to the caller. Client hardening for prod: browser-only install (the module is also evaluated during SSR), relative exporter URLs resolved against the page origin, and per-SESSION sampling via VITE_PUBLIC_OTLP_SAMPLE_RATIO (a session traces everything or nothing — per-span sampling would shred waterfalls). vite dev strips the baked endpoint unless a local motel is actually listening, so plain bun dev doesn't post spans into a dead proxy. e2e keeps working unchanged (verified: 27 browser entries harvested on a fresh run).
RhysSullivan
force-pushed
the
claude/prod-browser-traces
branch
from
8c0d322 to
d53d12f
Compare
RhysSullivan
added a commit
that referenced
this pull request
Jun 12, 2026
#985) Every API/MCP request produced TWO identical sibling http.server spans: the worker-boundary span server.ts opens (scope executor-cloud-worker) AND the one Effect's HttpMiddleware.tracer opens for app-owned paths (scope executor-cloud) — both joined the caller's traceparent, so the waterfall showed a childless twin next to the real envelope, and server span ingest was doubled (visible in Axiom: 39.7k executor-cloud vs 24.9k executor-cloud-worker spans on /mcp alone). The worker now skips its span for app-owned paths (app-paths.ts: /api/*, /mcp, /.well-known/*) — Effect's middleware already parses traceparent and parents the workos/store/db children there. Non-app paths (Start SSR, marketing proxy, /_astro assets) keep the worker envelope span, and the flush-on-waitUntil still runs on both branches so batched exports survive the isolate. Verified against the suite motel: API scenario + browser scenario runs now record exactly one http.server per trace (worker scope only on / and SSR routes), browser→server join intact (executor-web client span → executor-cloud server span → workos/user_store/fumadb children); cloud observability unit tests green. Found via the prod Axiom dataset right after #981 made browser traces land — the duplicate was previously invisible without the join.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The web client's OTLP exporter ships in the production build.
wrangler.jsoncbakesVITE_PUBLIC_OTLP_TRACES_URL=/v1/traces; the client resolves relative endpoints against the page origin (previews get tracing for free).apps/cloud/src/observability/browser-traces.ts) forwards browser span batches to Axiom with the server-held token — the browser never seesAXIOM_TOKEN. It runs before the worker's server span (exporter traffic doesn't trace itself), requires a session cookie to be present, caps bodies at 2MB, accepts-and-drops when Axiom isn't configured, and never reflects the upstream response. Unit-tested.VITE_PUBLIC_OTLP_SAMPLE_RATIO(a session traces everything or nothing — per-span sampling would shred waterfalls; currently 1).vite devstrips the baked endpoint unless a local motel is listening, so plainbun devdoesn't post spans into a dead proxy every second.No new deploy-time secrets — reuses the existing
AXIOM_TOKEN. After deploy, "why was that page slow for this user" is answerable in Axiom with the same click→server→DB waterfall the e2e suite gets from motel locally.Stack